rizimaher

08/29 00:21

Attacker Drains More Than $1 Million From Avici Us

# Trending Token Price Prediction Challenge #HTX 13th-Anniversary Carnival #HTX Creation Challenge — Post and Win 1,500U

HTXNắm giữGiao dịch

PnL chưa thực hiện (USDT)

+4.95

PnL%+0.00%

Chi phí0.00

Giá mới nhất0.000001688

Attacker Drains More Than $1 Million From Avici Users In Live Solana Neobank AttackAn attacker is draining customer funds from Avici, the Solana neobank that issues Visa cards backed by users' crypto, and had taken more than $1 million by press time. Avici sells its card as self-custodial, with balances held in onchain accounts users authorize through passkeys instead of seed phrases. The attacker went through that authorization layer, calling an instruction that registers a new administrator on a user's collateral account and then withdrawing the balance. The attacker's wallet, FVNFzq[…]QnCEj, held 10,005.03 $SOL worth about $1.07 million at 18:58 UTC, plus roughly $11,600 in $USDC and $USDT, according to Solana RPC data queried by The Defiant. Its $SOL balance grew by about 2,595 tokens, some $277,000, in the previous 11 minutes. Avici said in a post at 18:42 UTC that it is "working directly with all relevant partners to resolve it and will share updates as soon as we have more information." The company has not said how the funds were taken, how many accounts are affected, or whether it will make users whole. Add Admin, Then Withdraw The wallet was funded with 1.79 $SOL bridged through deBridge at 13:40 UTC and sat idle for three hours. Its first call against Avici's contracts landed at 16:49:48 UTC. It has since signed 14,672 transactions, 2,344 of which failed. The pattern repeats per victim across three instructions, according to transaction logs. The wallet first calls SubmitSignatures on Avici's authorization program, in a transaction that also invokes Solana's Ed25519 signature-verification precompile. It then calls AddCollateralAdmin on Avici's collateral program, and finally WithdrawCollateralAsset on the same program. In one transaction reviewed by The Defiant, a single WithdrawCollateralAsset call moved 2,346.77 $USDT from a user’s collateral account to the attacker's token account. The wallet periodically swa

3Chia sẻ